The Daily Index — Thursday, December 18, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

AUTO PARTS GIANT LKQ CONFIRMS ORACLE EBS BREACH

Automotive parts supplier LKQ has confirmed it was hit in the Oracle E-Business Suite hacking campaign linked to the Cl0p ransomware group, exposing personal data, including SSNs and EINs, of over 9,000 sole proprietor suppliers. The company says the incident is limited to its Oracle EBS environment, though several terabytes of data were stolen, and notes it previously suffered a separate cyberattack affecting a Canadian business unit.

securityweek.com · 3 min

TLDR InfoSec

WHATSAPP DEVICE LINKING ABUSED IN ACCOUNT HIJACKING ATTACKS

Gen Digital researchers have uncovered a new phishing campaign, which they dubbed GhostPairing, that abuses the device-linking feature of WhatsApp to hijack accounts. The victims are contacted by a known contact that shares a link allegedly leading to an online photo of a victim, which leads to a fake Facebook site that requests the user to initiate a device-linking process to log in. Attackers can then use the victim's account to forward the initial lure and propagate.

bleepingcomputer.com · 2 min

TLDR InfoSec

WE SHOULD ALL BE USING DEPENDENCY COOLDOWNS

Analysis of recent supply chain attacks, including xz-utils, Ultralytics, tj-actions, and web3.js, revealed that most exploitation windows last only hours to days before detection and remediation. 8 out of 10 examined attacks had windows under one week. Implementing a 7-14 day dependency cooldown via Dependabot or Renovate would have prevented 80-90% of these attacks by simply waiting for compromised packages to be identified and removed before adoption. The technique is free, easy to configure, and among the most effective mitigations against mass-impact supply chain compromises.

blog.yossarian.net · 4 min

TLDR InfoSec

DETECTING MALICIOUS PULL REQUESTS AT SCALE WITH LLMS

Datadog's BewAIre is an LLM-powered system that reviews every pull request for malicious intent. Achieving over 99.3% accuracy and a 0.03% false positive rate after six months of tuning, the system addresses limitations of traditional static analysis by detecting intent-based attacks, such as credential exfiltration and obfuscated payloads, and by using recursive diff chunking to handle large PRs that attackers exploit to hide malicious code. Security teams can apply similar approaches by combining curated malicious datasets, prompt engineering with pattern exclusions, and adversarial red-teaming to build LLM-based detection that complements existing SAST/SCA tooling.

datadoghq.com · 13 min

TLDR InfoSec

AUTHORIZING ACCESS TO DATA WITH RAG IMPLEMENTATIONS

Retrieval-Augmented Generation (RAG) is commonly used by organizations to augment an LLM's knowledge base with additional information, such as internal documentation. RAG poses authorization risks as the LLM performs the search, so any authorization checks at the data source are skipped. This tutorial shows how to use S3 Access Grants with Amazon Bedrock Knowledge Bases to add authorization checks to the RAG flow.

aws.amazon.com · 6 min

TLDR InfoSec

DUX (PRODUCT LAUNCH)

Dux is an agentic exposure management startup that uses AI workers to analyze enterprise environments, identify exploitable attack paths, validate existing controls, and recommend lightweight mitigations to prevent vulnerability exploitation across assets.

dux.io

TLDR InfoSec

MOST PARKED DOMAINS NOW SERVING MALICIOUS CONTENT

Infoblox research shows over 90% of parked domains now redirect visitors to scams, malware, or infostealers, up from less than 5% a decade ago. Malicious redirects target residential IPs, while VPN users see safe parking pages. One threat actor controls nearly 3,000 typosquatting domains targeting major sites such as Gmail, YouTube, Netflix, and government sites, hosting a mail server to capture misaddressed emails for business email attacks. Users should use bookmarks instead of typing to avoid typosquatting.

krebsonsecurity.com · 6 min

TLDR InfoSec

THE 2025 CLOUDFLARE RADAR YEAR IN REVIEW: THE RISE OF AI, POST-QUANTUM, AND RECORD-BREAKING DDOS ATTACKS

Cloudflare recorded unprecedented DDoS attacks in 2025, with hyper-volumetric assaults reaching 31.4 Tbps and 14 Bpps. During this period, global Internet traffic increased by 19%, and AI crawler activity surged, with Googlebot accounting for 4.5% of HTML requests and user action crawling rising over 15 times. Adoption of post-quantum encryption nearly doubled, covering 52% of human-generated web traffic. An email security analysis revealed 5.6% of messages as malicious, mainly due to deceptive links. 174 major Internet outages were documented, with nearly half caused by government-enforced shutdowns. Security professionals should closely watch the expanding capacity for hyper-volumetric DDoS attacks, adopt post-quantum cryptography as it becomes widely used, and enhance email security measures against sophisticated impersonation and brand deception attacks enabled by AI-generated content.

blog.cloudflare.com · 47 min

TLDR InfoSec

MICROSOFT SECURITY UPDATES BREAKS MSMQ ON OLDER WIN SYSTEMS

Microsoft acknowledges that December 2025 security updates have broken Microsoft Message Queuing on some older Windows 10 and Windows Server systems, causing inactive queues. The root cause is tightened NTFS permissions on the MSMQ storage folder, which now block required write access for MSMQ users. Only older, mostly enterprise systems are affected. There is no proper fix beyond workarounds or uninstalling the update.

theregister.com · 3 min

TLDR InfoSec

TRUFFLEHOG NOW DETECTS JWTS WITH PUBLIC-KEY SIGNATURES AND VERIFIES THEM FOR LIVENESS

TruffleHog's new JWT detector identifies public-key-signed tokens and verifies liveness through local claim validation and OIDC Discovery.

trufflesecurity.com · 7 min

TLDR InfoSec

KIMWOLF BOTNET HIJACKS 1.8 MILLION ANDROID TVS, LAUNCHES LARGE-SCALE DDOS ATTACKS

Kimwolf is a large DDoS botnet that hijacked around 1.8 million Android TVs, TV boxes, and tablets worldwide to flood targets with traffic.

thehackernews.com · 2 min

TLDR InfoSec

'INK DRAGON' THREAT GROUP TARGETS IIS SERVERS TO BUILD STEALTHY GLOBAL NETWORK

Chinese-linked threat group Ink Dragon is compromising misconfigured IIS servers at government organizations in Europe, Asia, and South America to create a stealthy mesh relay network that obscures C2 traffic origins.

csoonline.com · 1 min